Splunk Search

How to do log analysis using splunk

srinivas0704
New Member

I am working on approach to upload logs to splunk,I have set of queries to query in logs and extract the values.How to run queries as soon as one user uploads logs without himself querying and give him the results

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @srinivas0704,
you could create an alert, running e.g. every five minutes that checks logs upload and send an email with the results.
the problem is: how many users do you have for this job? if they are a limited number you could create an alert for each one with his email, if they are many is more difficoult.

ciao.
Giuseppe

0 Karma

srinivas0704
New Member

@gcusello Thanks for looking into, there are many. Is there some way when user uploads the logs it does all the queries automatically and show result

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @srinivas0704,
you could create a dashboard that displays all the data in an index, but the user should insert some parameters to find the uploaded logs (e.g. source or index or sourcetype).

One question: when you speak of log upload, are you speaking of the UI guided procedure?
if yes at the end of the procedure Splunk shows a button to display all the loaded events.

ciao.
Giuseppe

0 Karma

srinivas0704
New Member

@gcusello Log upload is about application logs which user uploads himself and he should get to know whats the issue on uploading logs

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @srinivas0704,
as i said, at the end of the UI guided procedure user has a button to display all the loaded events.

ciao.
Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust
0 Karma

srinivas0704
New Member

@gcusello Thanks will refer this

0 Karma

srinivas0704
New Member

@gcusello Checked the video but they are still querying. Sry if I am not clear. I have a list of queries which should be executed on each and every logs user uploads and give results to them of queries executed

0 Karma

gcusello
SplunkTrust
SplunkTrust

The only way is to create more alert with all your queries and send results to you users, otherwise, they can access results in alerts.
Ciao.
Giuseppe

0 Karma

srinivas0704
New Member

ok will check this,thanks @gcusello

0 Karma

srinivas0704
New Member

@gcusello Do you have any guide on how to load the events so that it displays all the loaded events or queries

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...